Posted by Michael Fesser on 12/05/06 18:55

..oO(mantrid)

>The function I have uses eregi()

eregi() should be avoided. The preg_* functions are faster and much more
flexible. Additionally in PHP 6 the ereg extension will be removed from
the core and moved to PECL, so it might not be available by default.

>to check POST data for "cc:" and "subject:"
>what other checks should I be using in my function to tighten my security
>further?

I wouldn't check for any particular header field at all, but for all
kinds of line breaks, which are required to inject malicious headers.

Micha

[Back to original message]